Software Security Testing Flashcards
A measure of the system’s ability to protect data and information from unauthorized access while still providing access to people and systems that are authorized
Security
An action taken against a computer system with the intention of doing harm is called an ____
Attack
CIA approach to security
- Confidentiality
- Integrity
- Availability
What are other security characteristics?
- Authentication
- Nonrepudiation
- Authorization
Data or services are protected from unauthorized access
Confidentiality
Data or services are not subject to unauthorized manipulation
Integrity
The system will be available for legitimate use
Availability
Verifies the identities of the parties to a transaction and checks if they are truly who they claim to be
Authentication
Guarantees that the sender of a message cannot later deny having sent the message, and that the recipient cannot deny having received the message
Nonrepudiation
Grants a user the privileges to perform a task
Authorization
Human or another system which may have been previously certified (either correctly or incorrectly) or may be currently unknown. A human attacker may be from outside the organization or from inside the organization
Source
Unauthorized attempt is made to display data, change or delete data, access system services, change the system’s behavior, or reduce availability
Stimulus
T/F Software design reviews can evaluate security
T
T/F Data flows (and therefore data flow diagrams) can not be used for security analysis
F, they can
T/F Reused and off-the-shelf software components should meet the same security requirements as new software
T
T/F Construction languages and their implementations (for example, compilers) are not serious contributors to security vulnerabilities
F
Special form of random testing aimed at breaking the software often used for security testing
Fuzz testing
T/F Security, in terms of access control and the backup facilities, is a key aspect of library management
T
Builds security in software by following a set of established and/or recommended rules and practices in software development
Secure software development
T/F A generally accepted view concerning software security is that it is much better to design security into software than to patch it in after software is developed
T
T/F Security faults and loopholes can be and often are introduced during maintenance
T
Deals with the clarification and specification of security policy and objectives into software requirements
Software requirements security
Specific functions that are required for the sake of security
Software requirements
Possible ways that the security of software is threatened
Threats/risks
What type of requirements are security requirements?
“Shall not” requirements
T/F It is possible to define this unwanted behavior as simple constraints to be checked by the system
F
T/F It is impossible to prove that a system does not do something
T
Can you derive requirements for an unknown type of attack?
No
Deals with the design of software modules that fit together to meet the security objectives specified in the security requirements
Software design security
T/F Factors considered may include frameworks and access modes that set up the overall security monitoring/enforcement strategies, as well as the individual policy enforcement mechanisms
T
Concerns the question of how to write actual programming code for specific situations such that security considerations are taken care of
Software construction security
T/F When an error occurs, the program should restore the state of the software to the state it had before the process began, and then terminate
T
T/F The error status of every function does not need to be checked
F
Should your program share objects in memory with any other program?
No
Security concerns during software development may necessitate one or more software processes to protect the security of the development environment and reduce the risk of malicious acts
Adding security processes
Evaluate the degree to which a test item and its associated data are protected so that unauthorized persons or systems cannot use, read, or modify them and authorized persons or systems are granted required access to them
Security testing
T/F Security requirements are concerned with the ability to protect the data and functionality of a test item from unauthorized users and malicious use
T
Involves attempted access to a test item (including
its functionality and/or private data) by a tester that is
mimicking the actions of an unauthorized user
Penetration testing
Involves attempted access to private data and verification of the audit trail (i.e., trace) that is left behind when users access private data
Privacy testing
A type of static testing in which a tester inspects, reviews, or walks through the requirements and code of a test item to determine whether any security vulnerabilities are present
Security auditing
Involves the use of automated testing tools to scan a
test item for signs of specific known vulnerabilities
Vulnerability scanning
